{"id":"CVE-2024-35971","state":"PUBLISHED","title":"net: ks8851: Handle softirqs at the end of IRQ thread to fix hang","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ks8851: Handle softirqs at the end of IRQ thread to fix hang\n\nThe ks8851_irq() thread may call ks8851_rx_pkts() in case there are\nany packets in the MAC FIFO, which calls netif_rx(). This netif_rx()\nimplementation is guarded by local_bh_disable() and local_bh_enable().\nThe local_bh_enable() may call do_softirq() to run softirqs in case\nany are pending. One of the softirqs is net_rx_action, which ultimately\nreaches the driver .start_xmit callback. If that happens, the system\nhangs. The entire call chain is below:\n\nks8851_start_xmit_par from netdev_start_xmit\nnetdev_start_xmit from dev_hard_start_xmit\ndev_hard_start_xmit from sch_direct_xmit\nsch_direct_xmit from __dev_queue_xmit\n__dev_queue_xmit from __neigh_update\n__neigh_update from neigh_update\nneigh_update from arp_process.constprop.0\narp_process.constprop.0 from __netif_receive_skb_one_core\n__netif_receive_skb_one_core from process_backlog\nprocess_backlog from __napi_poll.constprop.0\n__napi_poll.constprop.0 from net_rx_action\nnet_rx_action from __do_softirq\n__do_softirq from call_with_stack\ncall_with_stack from do_softirq\ndo_softirq from __local_bh_enable_ip\n__local_bh_enable_ip from netif_rx\nnetif_rx from ks8851_irq\nks8851_irq from irq_thread_fn\nirq_thread_fn from irq_thread\nirq_thread from kthread\nkthread from ret_from_fork\n\nThe hang happens because ks8851_irq() first locks a spinlock in\nks8851_par.c ks8851_lock_par() spin_lock_irqsave(&ksp->lock, ...)\nand with that spinlock locked, calls netif_rx(). Once the execution\nreaches ks8851_start_xmit_par(), it calls ks8851_lock_par() again\nwhich attempts to claim the already locked spinlock again, and the\nhang happens.\n\nMove the do_softirq() call outside of the spinlock protected section\nof ks8851_irq() by disabling BHs around the entire spinlock protected\nsection of ks8851_irq() handler. Place local_bh_enable() outside of\nthe spinlock protected section, so that it can trigger do_softirq()\nwithout the ks8851_par.c ks8851_lock_par() spinlock being held, and\nsafely call ks8851_start_xmit_par() without attempting to lock the\nalready locked spinlock.\n\nSince ks8851_irq() is protected by local_bh_disable()/local_bh_enable()\nnow, replace netif_rx() with __netif_rx() which is not duplicating the\nlocal_bh_disable()/local_bh_enable() calls.","publishedAt":"2024-05-20T09:41:59.174Z","updatedAt":"2026-08-05T11:31:19.610Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"797047f875b5463719cc70ba213eb691d453c946","status":"affected","lessThan":"492337a4fbd1421b42df684ee9b34be2a2722540","versionType":"git"},{"version":"797047f875b5463719cc70ba213eb691d453c946","status":"affected","lessThan":"cba376eb036c2c20077b41d47b317d8218fe754f","versionType":"git"},{"version":"797047f875b5463719cc70ba213eb691d453c946","status":"affected","lessThan":"49d5d70538b6b8f2a3f8f1ac30c1f921d4a0929b","versionType":"git"},{"version":"797047f875b5463719cc70ba213eb691d453c946","status":"affected","lessThan":"be0384bf599cf1eb8d337517feeb732d71f75a6f","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/micrel/ks8851_common.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.8","versionType":"semver"},{"version":"6.1.87","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.28","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.8.7","status":"unaffected","lessThanOrEqual":"6.8.*","versionType":"semver"},{"version":"6.9","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/micrel/ks8851_common.c"]}],"references":["https://git.kernel.org/stable/c/492337a4fbd1421b42df684ee9b34be2a2722540","https://git.kernel.org/stable/c/cba376eb036c2c20077b41d47b317d8218fe754f","https://git.kernel.org/stable/c/49d5d70538b6b8f2a3f8f1ac30c1f921d4a0929b","https://git.kernel.org/stable/c/be0384bf599cf1eb8d337517feeb732d71f75a6f","http://www.openwall.com/lists/oss-security/2024/05/30/2","http://www.openwall.com/lists/oss-security/2024/05/30/1"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:30.303Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/35xxx/CVE-2024-35971.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-35971","state":"PUBLISHED","datePublished":"2024-05-20T09:41:59.174Z","dateUpdated":"2026-08-05T11:31:19.610Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-05-17T13:50:33.141Z"},"containers":{"cna":{"title":"net: ks8851: Handle softirqs at the end of IRQ thread to fix hang","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ks8851: Handle softirqs at the end of IRQ thread to fix hang\n\nThe ks8851_irq() thread may call ks8851_rx_pkts() in case there are\nany packets in the MAC FIFO, which calls netif_rx(). This netif_rx()\nimplementation is guarded by local_bh_disable() and local_bh_enable().\nThe local_bh_enable() may call do_softirq() to run softirqs in case\nany are pending. One of the softirqs is net_rx_action, which ultimately\nreaches the driver .start_xmit callback. If that happens, the system\nhangs. The entire call chain is below:\n\nks8851_start_xmit_par from netdev_start_xmit\nnetdev_start_xmit from dev_hard_start_xmit\ndev_hard_start_xmit from sch_direct_xmit\nsch_direct_xmit from __dev_queue_xmit\n__dev_queue_xmit from __neigh_update\n__neigh_update from neigh_update\nneigh_update from arp_process.constprop.0\narp_process.constprop.0 from __netif_receive_skb_one_core\n__netif_receive_skb_one_core from process_backlog\nprocess_backlog from __napi_poll.constprop.0\n__napi_poll.constprop.0 from net_rx_action\nnet_rx_action from __do_softirq\n__do_softirq from call_with_stack\ncall_with_stack from do_softirq\ndo_softirq from __local_bh_enable_ip\n__local_bh_enable_ip from netif_rx\nnetif_rx from ks8851_irq\nks8851_irq from irq_thread_fn\nirq_thread_fn from irq_thread\nirq_thread from kthread\nkthread from ret_from_fork\n\nThe hang happens because ks8851_irq() first locks a spinlock in\nks8851_par.c ks8851_lock_par() spin_lock_irqsave(&ksp->lock, ...)\nand with that spinlock locked, calls netif_rx(). Once the execution\nreaches ks8851_start_xmit_par(), it calls ks8851_lock_par() again\nwhich attempts to claim the already locked spinlock again, and the\nhang happens.\n\nMove the do_softirq() call outside of the spinlock protected section\nof ks8851_irq() by disabling BHs around the entire spinlock protected\nsection of ks8851_irq() handler. Place local_bh_enable() outside of\nthe spinlock protected section, so that it can trigger do_softirq()\nwithout the ks8851_par.c ks8851_lock_par() spinlock being held, and\nsafely call ks8851_start_xmit_par() without attempting to lock the\nalready locked spinlock.\n\nSince ks8851_irq() is protected by local_bh_disable()/local_bh_enable()\nnow, replace netif_rx() with __netif_rx() which is not duplicating the\nlocal_bh_disable()/local_bh_enable() calls."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"797047f875b5463719cc70ba213eb691d453c946","status":"affected","lessThan":"492337a4fbd1421b42df684ee9b34be2a2722540","versionType":"git"},{"version":"797047f875b5463719cc70ba213eb691d453c946","status":"affected","lessThan":"cba376eb036c2c20077b41d47b317d8218fe754f","versionType":"git"},{"version":"797047f875b5463719cc70ba213eb691d453c946","status":"affected","lessThan":"49d5d70538b6b8f2a3f8f1ac30c1f921d4a0929b","versionType":"git"},{"version":"797047f875b5463719cc70ba213eb691d453c946","status":"affected","lessThan":"be0384bf599cf1eb8d337517feeb732d71f75a6f","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/micrel/ks8851_common.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.8","versionType":"semver"},{"version":"6.1.87","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.28","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.8.7","status":"unaffected","lessThanOrEqual":"6.8.*","versionType":"semver"},{"version":"6.9","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/micrel/ks8851_common.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/492337a4fbd1421b42df684ee9b34be2a2722540"},{"url":"https://git.kernel.org/stable/c/cba376eb036c2c20077b41d47b317d8218fe754f"},{"url":"https://git.kernel.org/stable/c/49d5d70538b6b8f2a3f8f1ac30c1f921d4a0929b"},{"url":"https://git.kernel.org/stable/c/be0384bf599cf1eb8d337517feeb732d71f75a6f"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The deadlock is triggered purely by a received Ethernet frame whose RX processing emits an immediate reply in softirq context — ICMP echo requests, TCP SYNs eliciting SYN-ACKs, and forwarded traffic all do this and are routable from an arbitrary remote host, not just the local segment. Per net/ stack guidance, bugs reachable via received packets are Network.\nAC:L - The attacker fully controls the trigger by sending a single packet that elicits a reply (ping, ARP request, TCP SYN); no race, memory layout, or victim state is involved, and the hang even occurs under ordinary legitimate traffic.\nPR:N - The vulnerable code runs in the NIC's threaded IRQ handler on raw packet reception, entirely before any socket, authentication, or authorization check — an unauthenticated remote attacker needs no credentials on the target.\nUI:N - No victim action is required; the packet is processed automatically by the driver's interrupt thread as soon as it arrives on the wire.\nS:U - The recursive spinlock acquisition deadlocks the kernel itself, with no crossing of a virtualization, IOMMU, or sandbox boundary — impact stays within the same security authority.\nC:N - The bug is a lock-recursion deadlock with no out-of-bounds access, no use-after-free, and no leaked data; the fix only reorders BH handling and switches to __netif_rx(), confirming no information is exposed.\nI:N - No memory is corrupted and no data is modified — the CPU simply spins forever on a lock it already holds, giving no write primitive of any kind.\nA:H - Re-acquiring the non-recursive spinlock taken with spin_lock_irqsave() wedges the CPU with local interrupts disabled, producing a full system hang (unrecoverable without watchdog reset on the typical single-core embedded boards using the KS8851 parallel bus)."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:31:19.610Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.1.87"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.6.28"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.8.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.9"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-35971","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-05-20T15:04:05.232058Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:33:27.183Z"}},{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/492337a4fbd1421b42df684ee9b34be2a2722540","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/cba376eb036c2c20077b41d47b317d8218fe754f","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/49d5d70538b6b8f2a3f8f1ac30c1f921d4a0929b","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/be0384bf599cf1eb8d337517feeb732d71f75a6f","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/05/30/2","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/05/30/1","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T03:21:49.046Z"}}]}}}